Detecting malware variants via function-call graph similarity

Proceedings of the 5th IEEE International Conference on Malicious and Unwanted Software, Malware 2010

Volumn , Issue , 2010, Pages 113-120

  Shang, Shanhu ^a   Zheng, Ning ^a   Xu, Jian ^a   Xu, Ming ^a   Zhang, Haiping ^a  

^a HANGZHOU DIANZI UNIVERSITY   (China)

Author keywords

[No Author keywords available]

Indexed keywords

ASSEMBLE CODES; CALL GRAPHS; CODE OBFUSCATION; FALSE POSITIVE RATES; GRAPH-MATCHING METHODS; HIGH LEVEL SEMANTICS; MALWARES; NOVEL ALGORITHM; S-FUNCTION; SPECIFIC INSTRUCTION;

ALGORITHMS; COMPUTER CRIME; PATTERN MATCHING; SEMANTICS;

STATIC ANALYSIS;

EID: 78651389253     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/MALWARE.2010.5665787     Document Type: Conference Paper

References (23)

1. Annual Report PandaLabs 2009, http://www.pandasecurity.com!homeusers/ security-info/tools/reports/.
2. K. Griffin, S. Schneider, X. Hu and T.-c. Chiueh. Automatic generation of string signatures for malware detection. In Proceedings of RAID 2009, pages 101-120, Brittany, France, Sep. 2009.
3. M. Christodorescu and S. Jha. Testing malware detectors. In Proceedings of the ACM SIGSOFT International Symposium on Software Testing and Analysis 2004 (ISSTA'04), pages 34-44, Boston, MA, USA, ACM Press, July 2004.
4. J. Marie, Borello and L. Mé. Code obfuscation techniques for metamorphic viruses. Journal in Computer Virology, Volume 4, pages 211-220, 2008.
5. P. Szor. The art of computer virus research and defense. Symantec Press, USA, first edition, 2005.
6. M. Christodorescu and S. Jha. Static analysis of executables to detect malicious patterns. In Proceedings of the 12th conference on USENIX Security Symposium, Volume 12, Washington, DC, 2003.
7. M. Christodorescu, S. Jha, et al. Semantics-aware malware detection. In IEEE Symposium on Security and Privacy, May 2005.
8. Walenstein, R. Mathur, et al. Constructing malware normalizers using term rewriting. Journal in Computer Virology, Volume 4, pages 307-322, 2008.
9. D. Bruschi, L. Martignoni, M. Monga. Code normalization for self-mutating Malware. Journal in IEEE Security & Privacy, Volume 5, pages 46-54, 2007.
10. D. Bruschi, L. Martignoni, M. Monga. Detecting self-mutating malware using control-flow graph matching. In Detection of Intrusions and Malware & Vulnerability Assessment, Volume 4064, pages 129-143, Nov. 2006.
11. Z. Qinghua and D. S. MetaAware: Identifying metamorphic malware. In Proceedings of the 23th ACSAC on Computer Security Applications Conference, pages 411-420, Dec. 2007.
12. E. Carrera and G. Erdelyi. Digital genome mapping - Advanced binary malware analysis. In Proceedings of the 2004 Virus Bulletin Conference, 2004.
13. M. Christodorescu, S. Jha and C. Kruegel. Mining specifications of malicious behavior. In Proceedings of the ACM SIGSOFT symposium on the foundations of software engineering, pages 5-14, Dubrovnik, Croatia, 2007.
14. X. Hu, T.-c. Chiueh and K. G. Shin. Large-scale malware indexing using function-call graphs. In Proceedings of CCS 2009, pages 611-620, Chicago, Illinois, USA.
15. PeiD 0.95, http://www.peid.info/, 2010.
16. UPX 3.05, http://upx.sourceforge.net/, 2010.
17. IDA Pro 5.5, http://www.hex-rays.comlidapro/, 2010.
18. Microsoft Portable Executable and Common Object File Format Specification Revision 8.1. http://www.microsoft.com/whdc/system/platform/firmware/PECOFF. mspx, 2010.
19. Chris Eagle. The IDA Pro book, No Starch Press, first edition, Aug. 2008.
20. Thomas H. Cormen, Charles E. Leiserson, et al. Introduction to algorithms. MIT Press, second edition, 2001.
21. VX Heavens, http://vx.netlux.org/, 2010.
22. Kaspersky Monthly Malware Statistics: May 2009, http://www.kaspersky. comlnews?id=207575832, 2010.
23. md5 checksum, http://www.etree.org/md5com.html, 2010.